According to the Microsoft SC-300 official exam reference and Microsoft's official documentation, Azure AD Password Protection provides password policy enforcement and banned password protection for both cloud and on-premises environments.
The solution requires two primary components:
* Domain Controllers (DC Agents) - enforce password policies within the domain.
* Proxy Service (Azure AD Password Protection Proxy) - communicates with Azure AD to download the latest password policies and banned password lists and then shares them with the DC agents.
In the scenario, Server1 and Server2 are domain controllers that already have Azure AD Password Protection installed but cannot communicate with the internet directly. That means they rely on the proxy service running on a separate server to connect securely to Azure AD.
To ensure high availability, Microsoft recommends deploying at least two proxy servers. This ensures continuous synchronization of the password policy even if one proxy fails.
From the Microsoft documentation:
"For redundancy, deploy at least two proxy servers. The proxy service retrieves the global and custom banned password lists from Azure AD and replicates them to all domain controllers running the DC agent." Thus, installing the Azure AD Password Protection proxy service on Server4 ensures service continuity if one of the proxy servers fails.

Explanation:

In Conditional Access (CA), assignments determine who the policy applies to using Include and Exclude lists. A user targeted by Include but present in Exclude is not affected. CA evaluates all applicable policies for a sign-in. If any applicable policy has Block access , the sign-in is denied , even when other policies would grant access. When policies Grant access with conditions, the user must meet the configured controls (for example, Require device to be marked as compliant ) to succeed.
Applying these rules: Policy1 includes Group1 and excludes Group3 , targets All resources , and Blocks access . Group1 contains User1 and User3 ; Group3 contains User1 . Therefore, User1 is excluded from Policy1 and not blocked, but User3 remains included and is blocked from all resources. Policy2 includes Group2 , targets App1 , and Grants access requiring a compliant device . Group2 contains User2 and User3
; all devices (Device1-Device3) are Compliant . Thus, User2 can access App1 from Device2 because Policy2 is satisfied and no block applies. User1 is not in Group2 and not blocked by Policy1, so access to App1 from Device1 is allowed. User3 , however, is affected by Policy1 (Block) ; block overrides any grant in Policy2, so User3 cannot sign in to App1 from Device3 .

Explanation:

In Azure AD Privileged Identity Management (PIM), the activation settings shown for the Global Administrator role include "On activation, require Azure MFA: Yes." The SC-300 materials describe that when this flag is enabled, "eligible users must complete MFA during role activation." Therefore, User1, who is eligible for Global Administrator, must satisfy MFA at activation time.
The exhibit also shows "Require approval to activate: No (Approvers: None)." Per the exam guide, "if approvals are not required, no approver action is taken; users activate directly after satisfying policy (e.g., MFA, justification)." Consequently, there are no activation requests to approve, so User2 cannot approve all activation requests (there are none).
Regarding who can change role assignments, the guide states that "only Global Administrator or Privileged Role Administrator (Role Management Administrator) can add, remove, or update Azure AD role assignments in PIM." Privileged Authentication Administrator focuses on authentication method and MFA settings and does not grant role-assignment management. Thus, User2 (Privileged Authentication Administrator) cannot edit the assignment, while User3 (Global Administrator) can; since the statement claims both can edit, the correct evaluation is No.

As per the Microsoft Entra External Collaboration documentation and SC-300 exam guide, when guest invitations fail for a specific organization, it is typically caused by collaboration restrictions settings under External identities # Cross-tenant access settings.
"If you can invite users from one external tenant but not from another, verify the collaboration restrictions under External Identities settings. The setting 'Collaboration restrictions' allows or blocks invitations from specific domains." In this case, invitations from fabrikam.com work, but adatum.com fails - meaning adatum.com is likely blocked by collaboration restrictions. Adjusting these restrictions will allow guest invitations from adatum.
com.